Linux Compatible
  • News
    • Channels
    • Archive
    • Search
    • Submit
  • Articles
    • Categories
  • Knowledgebase
  • Compatibility
    • Search
  • Links
  • Forums
  • Twitter
Advertisement

Latest News
[ Windows | Linux | Apple ]

· ASUS ROG Strix Scar Edition Laptop Review and more
· Gunicorn Security Update for Debian 7
· ClamAV, Quagga and 6 more updates for Gentoo
· Dune HD PRO 4K Premium Compact Media Player Review and more
· Gigabyte Aorus X470 Gaming 7 Wifi Review and more
· Libreoffice and Libsdl2-image Updates for Debian 8/9
· Chromium and Cfitsio Updates for openSUSE
· MySQL-5.5 Security Update for Debian 8
· AMD 2nd Gen Ryzen Reviews and more
· Windows 10 Insider Preview Build 17650 released

Upcoming News
· Samsung 860 Pro SSD Review @ Vortez
· Raijintek Orcus 240 @ TechPowerUp
· Team Group Cardea Zero 240 GB @ TechPowerUp
· Guru3D Rig of the Month - January 2018
· Cooler Master MK750 Review @ Vortez
· Seagate Skyhawk 10TB SATA III HDD Review
· Vulkan Continues To Show Its Gaming Strength On Low-End Hardware
· Seagate IronWolf ST12000VN0007 12TB Hard Drive Review @ APH Networks
· Sennheiser Game One @ TechPowerUp
· be quiet! Straight Power 11 1000W Power Supply Review

Linux Compatibility
· Brother DCP-L2540DN
· Sound Blaster E5
· WD Elements 500GB external hard drive
· Canon D660U Flatbad scanner
· Umax Astra 4500 USB Scanner
· Logitech QuickCam Pro 4000
· Dell Latitude E6420
· Creative Sound Blaster Z
· Photosmart 5520
· TB-5300 Slimline Design Tablet

New Forum Topics
· Dale
by: Dale Blinco
on: 2018-02-05 00:26
1 replies, 1204 views

· modem driver needed
by: jongiffen777
on: 2017-12-13 11:11
1 replies, 2376 views

· Need a decent browser for XP Pro!
by: percy
on: 2017-12-05 11:02
2 replies, 4267 views

· Comodo Time Machine + Faronics Deep Freeze
by: Jabberwocky
on: 2017-11-15 23:17
1 replies, 2870 views

· Linux compatablity
by: ibme
on: 2017-10-04 18:05
1 replies, 4784 views

News Channels
· Drivers
· Guides
· Reviews
· Security
· Software
· Press Release
· Updates
· Interviews
· Linux
· General
· Debian
· Red Hat
· Slackware
· Gentoo
· Mandriva
· White Box
· SUSE
· GNOME
· KDE
· CentOS
· Ubuntu
· MEPIS
· Android
· Oracle Linux
· Arch Linux

What's New
Login to see an overview of all news stories since your last visit.

Welcome to our website

To take full advantage of all features you need to login or register. Registration is completely free and takes only a few seconds.

Linux Compatible » News » April 2012 » 5 Gentoo Updates

5 Gentoo Updates

Posted by Philipp Esselbach on: 04/18/2012 08:50 AM [ Print | 0 comment(s) ]

The following updates has been released for Gentoo Linux: [ GLSA 201204-08 ] Perl DBD-Pg Module: Arbitrary code execution, [ GLSA 201204-07 ] Adobe Flash Player: Multiple vulnerabilities, [ GLSA 201204-06 ] PolicyKit: Multiple vulnerabilities, [ GLSA 201204-05 ] SWFTools: User-assisted execution of arbitrary code, and [ GLSA 201204-04 ] FreeType: Multiple vulnerabilities




[ GLSA 201204-08 ] Perl DBD-Pg Module: Arbitrary code execution
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201204-08
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: Perl DBD-Pg Module: Arbitrary code execution
Date: April 17, 2012
Bugs: #407549
ID: 201204-08

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Two format string vulnerabilities have been found in the Perl DBD-Pg
module, allowing a remote PostgreSQL servers to execute arbitrary code.

Background
==========

DBD-Pg is a PostgreSQL interface module for Perl.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 dev-perl/DBD-Pg < 2.19.0 >= 2.19.0

Description
===========

Format string vulnerabilities have been found in the the "pg_warn()"
and "dbd_st_prepare()" functions in dbdimp.c.

Impact
======

A remote PostgreSQL server could send specially crafted database
warnings or DBD statements, possibly resulting in execution of
arbitrary code.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All users of the Perl DBD-Pg module should upgrade to the latest
version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-perl/DBD-Pg-2.19.0"

References
==========

[ 1 ] CVE-2012-1151
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1151

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201204-08.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======

Copyright 2012 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5




[ GLSA 201204-07 ] Adobe Flash Player: Multiple vulnerabilities
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201204-07
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: Adobe Flash Player: Multiple vulnerabilities
Date: April 17, 2012
Bugs: #390149, #404101, #407023, #410005
ID: 201204-07

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple vulnerabilities in Adobe Flash Player, the worst of which
might allow remote attackers to execute arbitrary code.

Background
==========

The Adobe Flash Player is a renderer for the SWF file format, which is
commonly used to provide interactive websites.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 www-plugins/adobe-flash < 11.2.202.228 >= 11.2.202.228

Description
===========

Multiple vulnerabilities have been discovered in Adobe Flash Player.
Please review the CVE identifiers referenced below for details.

Impact
======

A remote attacker could entice a user to open a specially crafted SWF
file, possibly resulting in execution of arbitrary code with the
privileges of the process or a Denial of Service condition.
Furthermore, a remote attacker may be able to bypass intended access
restrictions, bypass cross-domain policy, inject arbitrary web script,
or obtain sensitive information.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All Adobe Flash Player users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.228"

References
==========

[ 1 ] CVE-2011-2445
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2445
[ 2 ] CVE-2011-2450
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2450
[ 3 ] CVE-2011-2451
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2451
[ 4 ] CVE-2011-2452
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2452
[ 5 ] CVE-2011-2453
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2453
[ 6 ] CVE-2011-2454
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2454
[ 7 ] CVE-2011-2455
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2455
[ 8 ] CVE-2011-2456
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2456
[ 9 ] CVE-2011-2457
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2457
[ 10 ] CVE-2011-2458
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2458
[ 11 ] CVE-2011-2459
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2459
[ 12 ] CVE-2011-2460
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2460
[ 13 ] CVE-2012-0752
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0752
[ 14 ] CVE-2012-0753
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0753
[ 15 ] CVE-2012-0754
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0754
[ 16 ] CVE-2012-0755
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0755
[ 17 ] CVE-2012-0756
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0756
[ 18 ] CVE-2012-0767
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0767
[ 19 ] CVE-2012-0768
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0768
[ 20 ] CVE-2012-0769
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0769
[ 21 ] CVE-2012-0773
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0773

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201204-07.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======

Copyright 2012 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5




[ GLSA 201204-06 ] PolicyKit: Multiple vulnerabilities
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201204-06
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: High
Title: PolicyKit: Multiple vulnerabilities
Date: April 17, 2012
Bugs: #314535, #364973, #401513
ID: 201204-06

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple vulnerabilities have been found in PolicyKit, the worst of
which may allow a local attacker to gain root privileges.

Background
==========

PolicyKit is a toolkit for controlling privileges for system-wide
services.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 sys-auth/polkit < 0.104-r1 >= 0.104-r1

Description
===========

Multiple vulnerabilities have been found in PolicyKit:

* Error messages in the pkexec utility disclose the existence of local
files (CVE-2010-0750).
* The pkexec utility initially checks the effective user ID of its
parent process for authorization, instead of checking the real user
ID (CVE-2011-1485).
* Members of the "wheel" group are able to execute commands as an
administrator without a password (CVE-2011-4945).

Impact
======

A local attacker could gain elevated privileges or sensitive
information.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All PolicyKit users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=sys-auth/polkit-0.104-r1"

References
==========

[ 1 ] CVE-2010-0750
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0750
[ 2 ] CVE-2011-1485
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1485
[ 3 ] CVE-2011-4945
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4945

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201204-06.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======

Copyright 2012 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5




[ GLSA 201204-05 ] SWFTools: User-assisted execution of arbitrary code
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201204-05
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: SWFTools: User-assisted execution of arbitrary code
Date: April 17, 2012
Bugs: #332649
ID: 201204-05

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

A heap-based buffer overflow in SWFTools could result in the execution
of arbitrary code.

Background
==========

SWFTools is a collection of SWF manipulation and generation utilities
written by Rainer Böhme and Matthias Kramm.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 media-gfx/swftools <= 0.9.1 Vulnerable!
-------------------------------------------------------------------
NOTE: Certain packages are still vulnerable. Users should migrate
to another package if one is available or wait for the
existing packages to be marked stable by their
architecture maintainers.

Description
===========

Integer overflow errors in the "getPNG()" function in png.c and the
"jpeg_load()" function in jpeg.c could cause a heap-based buffer
overflow.

Impact
======

A remote attacker could entice a user to open a specially crafted PNG
or JPEG file, possibly resulting in execution of arbitrary code with
the privileges of the process, or a Denial of Service condition.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

Gentoo discontinued support for SWFTools. We recommend that users
unmerge swftools:

# emerge --unmerge "media-gfx/swftools"

References
==========

[ 1 ] CVE-2010-1516
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1516

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201204-05.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======

Copyright 2012 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5




[ GLSA 201204-04 ] FreeType: Multiple vulnerabilities
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201204-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: FreeType: Multiple vulnerabilities
Date: April 17, 2012
Bugs: #407257
ID: 201204-04

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple vulnerabilities have been found in FreeType, allowing remote
attackers to possibly execute arbitrary code or cause Denial of
Service.

Background
==========

FreeType is a high-quality and portable font engine.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 media-libs/freetype < 2.4.9 >= 2.4.9

Description
===========

Multiple vulnerabilities have been discovered in FreeType. Please
review the CVE identifiers referenced below for details.

Impact
======

A remote attacker could entice a user to open a specially crafted font,
possibly resulting in execution of arbitrary code with the privileges
of the user running the application, or a Denial of Service condition.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All FreeType users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/freetype-2.4.9"

References
==========

[ 1 ] CVE-2012-1126
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1126
[ 2 ] CVE-2012-1127
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1127
[ 3 ] CVE-2012-1128
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1128
[ 4 ] CVE-2012-1129
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1129
[ 5 ] CVE-2012-1130
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1130
[ 6 ] CVE-2012-1131
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1131
[ 7 ] CVE-2012-1132
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1132
[ 8 ] CVE-2012-1133
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1133
[ 9 ] CVE-2012-1134
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1134
[ 10 ] CVE-2012-1135
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1135
[ 11 ] CVE-2012-1136
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1136
[ 12 ] CVE-2012-1137
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1137
[ 13 ] CVE-2012-1138
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1138
[ 14 ] CVE-2012-1139
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1139
[ 15 ] CVE-2012-1140
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1140
[ 16 ] CVE-2012-1141
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1141
[ 17 ] CVE-2012-1142
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1142
[ 18 ] CVE-2012-1143
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1143
[ 19 ] CVE-2012-1144
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1144

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201204-04.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======

Copyright 2012 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5






Bookmark and Share

« Update for Root Certificates For Windows XP [April 2012] (KB931125) · Kernel Updates for RHEL »

Linux Compatible » News » April 2012 » 5 Gentoo Updates
All products mentioned are registered trademarks or trademarks of their respective owners.
© 2002-2018 Esselbach Internet Solutions - All Rights Reserved. Terms and privacy policy
Powered by Contentteller® Business Edition